cyber.hendryadrian.com
Threat Research · elastic.co

Elastic Research Shows Custom Obfuscation Can Stall LLM Reverse Engineering

· Original article ↗

Summary

Elastic researchers benchmarked Claude Opus 4.6 on Tigress-obfuscated binaries and built three custom obfuscators that exploited static-analysis limits, sharply increasing analysis time and cost and preventing password recovery in some tests.

Key points

  • Claude Opus 4.6 solved 40% of 20 evaluable Tigress targets; it solved none of the Phase 3 targets with the heaviest transformation combinations.
  • JIT-style obfuscation and nested virtualization were among the most challenging transforms; aggressive hardening increased cost and time by up to 4.5x and 4.3x, respectively.
  • Matryoshka Wall chained 100,000 ChaCha20 decryption stages, making sequential static emulation costly; a second version exhausted the project’s $10 per-binary limit without recovering the password.
  • Double Fond concealed a crackme behind modified libgcrypt dispatch and misleading benign functionality; the hardened version stymied the model even when it was told to look for hidden code.
  • Dispatch Maze scattered cipher fragments among 3,000 similar functions; its hardened version increased analysis time and cost but prevented password recovery.
  • The authors report that prompt-injection strings embedded in test binaries did not succeed against Opus 4.6.

Article Details

Attack Vectors
  • The Matryoshka Wall test binary concealed its crackme behind 100,000 sequential ChaCha20 decryption stages, with each stage's key depending on data revealed by decrypting the preceding stage.
  • Double Fond concealed a payload using patched libgcrypt dispatch, encrypted function pointers, a hidden loader, and an RWX segment named .note.fips.
  • Dispatch Maze split the cipher across 20 functions among 3,000 similar functions and used data-dependent state transitions, decoy functions, and varied transition templates.
Defensive Notes
  • The research found that static-analysis obfuscation can increase LLM analysis time and cost; the Matryoshka Wall and Dispatch Maze tests caused Claude Opus 4.6 to fail within the tested limits.
  • The article reports that Dispatch Maze version 2 used 91 transit decoys in addition to the 20 cipher-bearing functions and caused the model to spend 3.8 times longer and 3.4 times more while failing to recover the password.
  • The authors focused on static-analysis defenses and noted that their approach may become less effective as LLM agents gain dynamic-execution tooling.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe test binaries used control-flow flattening, mixed Boolean-arithmetic expressions, virtualization, and chained encryption to obscure program logic.T1036 · MasqueradingThe Double Fond test patched a library version string to make an older patched libgcrypt version appear to be the latest version.T1140 · Deobfuscate/Decode Files or InformationThe Matryoshka Wall loader decrypted chained ChaCha20 stages to recover the embedded crackme payload.T1620 · Reflective Code LoadingThe Double Fond loader decrypted a payload into a pre-allocated RWX segment named .note.fips and executed it as shellcode.

Products

Claude Opus 4.6Elastic benchmarked Claude Opus 4.6 against Tigress-obfuscated binaries and developed three custom obfuscators that significantly increased the time and cost required for static LLM-driven reverse engineering.

Tools

Caveman pluginBenchmark pipeline used controller/worker Opus instances with IDA Pro via MCP and Caveman plugin to reduce fluff and measure progress, cost, and time per target.IDA ProBenchmark pipeline used controller/worker Opus instances with IDA Pro via MCP and Caveman plugin to reduce fluff and measure progress, cost, and time per target.TigressElastic benchmarked Claude Opus 4.6 against Tigress-obfuscated binaries and developed three custom obfuscators that significantly increased the time and cost required for static LLM-driven reverse engineering.

Related Articles